goauthentik / goauthentik/authentik

Web Certificate not being used

Open
#18,544 5 comments 2 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

It uses the default self signed certificate, instead of the assigned certificate.

I Name and paste the LetsEncrypt certificate and key into the System->Certificates>Import UI. (I have also tried the cmd line import with same result)
In System->Brand>Edit I change the selection from the selfsigned certificate, to the name given above.

When I connect via. https i get a security warning in my browser since it still gets the self-signed certificate.

If I delete the self-signed certificate in System->Certificates then I get the LetsEncrypt certificate as expected (i.e. no browser warning, and the certificate is a LetsEncrypt cert).
If I restart the docker container, it generates a new selfsigned certificate, and used this for https.

So after every restart I have to accept the unsafe certificate in my browser, and then log in and delete the newly self-signed certificate. When the self-signed certificate have been deleted I get the correct valid certificate in my browser.

Question:
Are the Authentik running its own DNS resolver ? and trying to be "smart" about the certificate selection?
I'm running an split DNS on my domain, so the DNS lookup will give different IP depending if you ask the WAN side or the LAN side DNS. IP address of LAN side DNS is server is provided by DHCP,

### How to reproduce

1. I Name and paste the LetsEncrypt certificate and key into the System->Certificates>Import UI
2. In System->Brand>Edit I change the selection from the selfsigned certificate, to the name given above
3. The system uses the imported certificate for HTTPS.
4. Restart docker container
5. A self signed certificate is used for HTTPS.

### Expected behavior

1. I Name and paste the LetsEncrypt certificate and key into the System->Certificates>Import UI
2. In System->Brand>Edit I change the selection from the selfsigned certificate, to the name given above
3. The system uses the imported certificate for HTTPS.
4. Restart docker container
5. The system uses the imported certificate for HTTPS.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.10.0

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.